Add Audible region config and user password change modal

Implements configurable Audible region selection in setup and admin settings, affecting all Audible API calls and triggering data refresh on change. Adds a user-facing 'Change Password' modal in the header for local users, moving password change from admin-only to all local users via a new /api/auth/change-password endpoint. Updates documentation, API routes, and context to support these features, and removes the old admin-only password change flow.

documentation/TABLEOFCONTENTS.md

@@ -92,7 +92,7 @@
 **"How do I configure external services?"** → [setup-wizard.md](setup-wizard.md), [settings-pages.md](settings-pages.md)
 **"What's the database schema?"** → [backend/database.md](backend/database.md)
 **"How does authentication work?"** → [backend/services/auth.md](backend/services/auth.md)
-**"How do I change the admin password?"** → [settings-pages.md](settings-pages.md), [backend/services/auth.md](backend/services/auth.md)
+**"How do I change my password?"** → [backend/services/auth.md](backend/services/auth.md) (local users only - accessed via user menu in header)
 **"How do I delete requests?"** → [admin-features/request-deletion.md](admin-features/request-deletion.md)
 **"How do I deploy?"** → [deployment/docker.md](deployment/docker.md) (multi-container), [deployment/unified.md](deployment/unified.md) (all-in-one)
 **"How do I use the unified container?"** → [deployment/unified.md](deployment/unified.md)

documentation/backend/services/auth.md

@@ -54,7 +54,7 @@ Handles authentication and authorization: Multiple auth providers (Plex OAuth, O
 **POST /api/auth/plex/switch-profile** - Switch to selected profile and complete authentication
 **POST /api/auth/refresh** - Get new access token (refresh token in header)
 **POST /api/auth/logout** - Clear client-side token
-**GET /api/auth/me** - Get current user (JWT in header)
+**GET /api/auth/me** - Get current user (JWT in header), includes `authProvider` field ('plex' | 'oidc' | 'local')
 
 ## JWT Structure
 
@@ -110,10 +110,12 @@ Handles authentication and authorization: Multiple auth providers (Plex OAuth, O
 - Identified by: `isSetupAdmin=true` AND `plexId` starts with `local-`
 
 **Password Management:**
-- POST `/api/admin/settings/change-password` - Change local admin password
+- POST `/api/auth/change-password` - Change password for any local user
 - Requires: current password, new password (min 8 chars), confirmation
-- Security: Only accessible to local admin (verified via `requireLocalAdmin` middleware)
+- Security: Only accessible to users with `authProvider='local'` (Plex/OIDC users cannot change passwords)
 - Validates current password before allowing change
+- Properly decrypts stored password hash before bcrypt comparison
+- Available to all local users (setup admin, locally registered users)
 
 ## Plex Home Profile Support
 

documentation/frontend/components.md

@@ -23,7 +23,7 @@ src/components/
 ## Key Components
 
 **Layout**
-- **Header** - Top nav, search input, user menu
+- **Header** ✅ - Top nav, search input, user menu with "Change Password" option (local users only), logout
 - **Sidebar** - Admin side nav
 - **Footer** - Version, links
 
@@ -46,6 +46,7 @@ src/components/
 - **Select** - Custom styling, search/filter
 - **Modal** ✅ - Dialog overlay with backdrop, sizes (sm/md/lg/xl/full), ESC to close, body scroll lock
 - **ConfirmModal** ✅ - Confirmation dialog with customizable title, message, buttons, loading state, and variant (primary/danger)
+- **ChangePasswordModal** ✅ - Password change form for local users. Three fields (current, new, confirm), real-time validation, success/error states, auto-closes on success. Only accessible to users with `authProvider='local'`
 - **Pagination** ✅ - Traditional page navigation with prev/next buttons, smart ellipsis (shows 1...4 5 6...10)
 - **StickyPagination** ✅ - Minimal floating pill at bottom center with prev/next arrows, quick jump input, section label. Shows/hides based on section visibility (IntersectionObserver). Rounded-full design, backdrop blur, subtle shadow, auto-scroll on page change
 

documentation/integrations/audible.md

@@ -19,6 +19,46 @@ Audiobook metadata from Audnexus API (primary) and Audible.com scraping (fallbac
 - Multiple selector strategies with promotional text filtering
 - Extract JSON-LD structured data when available
 
+## Region Configuration
+
+**Status:** ✅ Implemented
+
+Configurable Audible region for accurate metadata matching across different international Audible stores.
+
+**Supported Regions:**
+- United States (`us`) - `audible.com` (default)
+- Canada (`ca`) - `audible.ca`
+- United Kingdom (`uk`) - `audible.co.uk`
+- Australia (`au`) - `audible.com.au`
+- India (`in`) - `audible.in`
+
+**Why Regions Matter:**
+- Each Audible region uses different ASINs for the same audiobook
+- Metadata engines (Audnexus/Audible Agent) in Plex/Audiobookshelf must match RMAB's region
+- Mismatched regions cause poor search results and failed metadata matching
+
+**Configuration:**
+- Key: `audible.region` (stored in database)
+- Default: `us`
+- Set during: Setup wizard (Backend Selection step) or Admin Settings (Library tab)
+- Help text instructs users to match their metadata engine region
+
+**Implementation:**
+- `AudibleService` loads region from config on initialization
+- Dynamically builds base URL: `AUDIBLE_REGIONS[region].baseUrl`
+- Audnexus API calls include region parameter: `?region={code}`
+- IP redirect prevention: `?ipRedirectOverride=true` on all Audible requests
+- Configuration service helper: `getAudibleRegion()` returns configured region
+- **Auto-detection of region changes**: Service checks config before each request and re-initializes if region changed
+- **Cache clearing**: When region changes, ConfigService cache and AudibleService initialization are cleared
+- **Automatic refresh**: Changing region automatically triggers `audible_refresh` job to fetch new data
+
+**Files:**
+- Types: `src/lib/types/audible.ts`
+- Service: `src/lib/integrations/audible.service.ts`
+- Config: `src/lib/services/config.service.ts`
+- API: `src/app/api/admin/settings/audible/route.ts`
+
 ## Discovery Strategy (Popular/New/Search)
 
 - Parse Audible HTML with Cheerio
@@ -28,10 +68,15 @@ Audiobook metadata from Audnexus API (primary) and Audible.com scraping (fallbac
 
 ## Data Sources
 
-1. **Best Sellers:** `https://www.audible.com/adblbestsellers`
-2. **New Releases:** `https://www.audible.com/newreleases`
-3. **Search:** `https://www.audible.com/search?keywords={query}`
-4. **Detail Page:** `https://www.audible.com/pd/{asin}`
+URLs dynamically built based on configured region:
+
+1. **Best Sellers:** `{baseUrl}/adblbestsellers`
+2. **New Releases:** `{baseUrl}/newreleases`
+3. **Search:** `{baseUrl}/search?keywords={query}&ipRedirectOverride=true`
+4. **Detail Page:** `{baseUrl}/pd/{asin}?ipRedirectOverride=true`
+5. **Audnexus API:** `https://api.audnex.us/books/{asin}?region={code}`
+
+Where `{baseUrl}` is determined by configured region (e.g., `https://www.audible.co.uk` for UK).
 
 ## Metadata Extracted
 

documentation/settings-pages.md

@@ -6,13 +6,39 @@ Single tabbed interface for admins to view/modify system configuration post-setu
 
 ## Sections
 
-1. **Plex** - URL, token (masked), library ID, filesystem scan trigger toggle
-2. **Audiobookshelf** - URL, API token (masked), library ID, filesystem scan trigger toggle
+1. **Plex** - URL, token (masked), library ID, Audible region, filesystem scan trigger toggle
+2. **Audiobookshelf** - URL, API token (masked), library ID, Audible region, filesystem scan trigger toggle
 3. **Prowlarr** - URL, API key (masked), indexer selection with priority, seeding time, RSS monitoring toggle
 4. **Download Client** - Type, URL, credentials (masked)
 5. **Paths** - Download + media directories
 6. **BookDate** - AI provider, API key (encrypted), model selection, library scope, custom prompt, swipe history
-7. **Account** - Local admin password change (only visible to setup admin)
+
+## Audible Region
+
+**Purpose:** Configure which Audible region to use for metadata and search to ensure accurate ASIN matching with your metadata engine.
+
+**Configuration:**
+- Key: `audible.region` (string, default: 'us')
+- Supported regions: US, Canada, UK, Australia, India
+- UI: Dropdown selector in Library tab (both Plex and Audiobookshelf settings)
+- No validation required (immediate save)
+
+**Why It Matters:**
+- Each Audible region uses different ASINs for the same audiobook
+- Users must match their RMAB region to their Plex/Audiobookshelf metadata engine region
+- Mismatched regions cause poor search results and failed metadata matching
+
+**Help Text:**
+"Select the Audible region that matches your metadata engine (Audnexus/Audible Agent) configuration in [Plex/Audiobookshelf]. This ensures accurate book matching and metadata."
+
+**Implementation:**
+- Affects all Audible API calls (base URL changes per region)
+- Affects all Audnexus API calls (region parameter added)
+- Changes apply immediately on next API call (no restart required)
+- **Automatic refresh**: Changing region automatically triggers `audible_refresh` job to fetch popular/new releases for the new region
+- **Cache management**: ConfigService cache and AudibleService initialization are cleared when region changes
+- **Smart re-initialization**: Service automatically detects region changes and re-initializes before each request
+- See: `documentation/integrations/audible.md` for technical details
 
 ## Filesystem Scan Trigger
 
@@ -72,19 +98,11 @@ Single tabbed interface for admins to view/modify system configuration post-setu
 4. **Save:** Updates user preferences immediately
 5. Accessible to all authenticated users
 
-**Account (local admin only):**
-1. Local admin can change password
-2. Requires: current password, new password (min 8 chars), confirmation
-3. No "Save Changes" button - uses dedicated "Change Password" button
-4. Form clears after successful change
-5. Only visible to users with `isSetupAdmin=true` AND `plexId` starts with `local-`
-
 **Validation state resets when:**
 - Plex: URL or token modified
 - Prowlarr: URL or API key modified (NOT indexer config)
 - Download Client: URL, username, or password modified
 - Paths: Directory paths modified
-- Account: No validation required (password change is immediate)
 
 ## API Endpoints
 
@@ -106,6 +124,11 @@ Single tabbed interface for admins to view/modify system configuration post-setu
 - Updates Prowlarr URL and API key
 - Requires prior successful test if values changed
 
+**PUT /api/admin/settings/audible**
+- Updates Audible region
+- Body: `{ region: string }` (one of: us, ca, uk, au, in)
+- No validation required
+
 **PUT /api/admin/settings/prowlarr/indexers**
 - Updates indexer configuration (enabled, priority, seeding time, RSS)
 - No test required if URL/API key unchanged
@@ -133,10 +156,6 @@ Single tabbed interface for admins to view/modify system configuration post-setu
 - GET /api/bookdate/preferences - Get user's preferences (libraryScope, customPrompt)
 - PUT /api/bookdate/preferences - Update user's preferences (all authenticated users)
 
-**Account Endpoints:**
-- POST /api/admin/settings/change-password - Change local admin password (local admin only)
-- GET /api/auth/is-local-admin - Check if current user is local admin (returns `{isLocalAdmin: boolean}`)
-
 ## Features
 
 - Password visibility toggle